🔒️(ci) set persist-credentials: false on actions/checkout

By default, `actions/checkout` saves the job's auth token
(`GITHUB_TOKEN` or the provided PAT) in the local git config so
later steps can run authenticated git commands. That token then
stays on disk for the rest of the job, where it can leak:

* If an artifact upload includes the checkout directory, the token
  is packaged with it and anyone with artifact access can extract
  it. On public repos that is anyone, and the token can be used
  while the job is still running ("ArtiPACKED", flagged by
  `zizmor` as `artipacked`).
* Any later step, third-party action, or build dependency can read
  the token from the git config, which widens the impact of a
  supply-chain compromise.

None of our workflows need authenticated git after checkout, so
disable credential persistence. If a step needs to push in

.github/workflows/ci.yml

@@ -88,6 +88,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Create writable /data
         run: |
@@ -159,6 +161,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install ffmpeg
         run: |
@@ -186,6 +190,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: cd src/frontend/ && npm ci --ignore-scripts
@@ -196,6 +202,27 @@ jobs:
       - name: Check format
         run: cd src/frontend/ && npm run check
 
+  test-front:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Install Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+        with:
+          node-version: "24"
+
+      - name: Install dependencies
+        run: cd src/frontend/ && npm ci --ignore-scripts
+
+      - name: Run tests
+        run: cd src/frontend/ && npm test
+
   lint-sdk:
     runs-on: ubuntu-latest
     permissions:
@@ -206,6 +233,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: npm ci --ignore-scripts
@@ -227,6 +256,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: npm ci --ignore-scripts

CHANGELOG.md

@@ -16,7 +16,7 @@ and this project adheres to
 - 🔧(summary) add setting to control Sentry traces sampling rate
 - ✨(frontend) let signed-out visitors start a meeting
 - ✨(backend) expose `allow_unregistered_rooms` in the frontend configuration
-- ✨(backend) authenticate external API calls with Menshen exchanged tokens
+- ✅(frontend) add vitest so the frontend can carry unit tests
 
 ### Changed
 

Makefile

@@ -260,7 +260,8 @@ lint-pylint: ## lint back-end python sources with pylint only on changed files f
 test: ## run project tests; pass extra pytest args via ARGS, e.g. `make test ARGS="-vv"`
 	@args="$(ARGS) $(filter-out $@,$(MAKECMDGOALS))" && \
 	$(MAKE) test-back-parallel ARGS="$${args}" && \
-	$(MAKE) test-summary ARGS="$${args}"
+	$(MAKE) test-summary ARGS="$${args}" && \
+	$(MAKE) test-frontend
 .PHONY: test
 
 test-back: ## run back-end tests (pass extra pytest args via ARGS)
@@ -278,6 +279,10 @@ test-summary: ## run summary tests (pass extra pytest args via ARGS)
 	bin/pytest-summary $${args}
 .PHONY: test-summary
 
+test-frontend: ## run the frontend unit tests
+	cd $(PATH_FRONT) && npm test
+.PHONY: test-frontend
+
 makemigrations:  ## run django makemigrations for the Meet project.
 	@echo "$(BOLD)Running makemigrations$(RESET)"
 	@$(COMPOSE) up -d postgresql

src/backend/core/external_api/authentication.py

@@ -4,51 +4,21 @@
 # ruff: noqa: PLR0913
 
 import logging
-from dataclasses import asdict
 
 from django.conf import settings
 from django.contrib.auth import get_user_model
 from django.core.exceptions import SuspiciousOperation
 
-import requests
 from lasuite.oidc_resource_server.backend import ResourceServerBackend as LaSuiteBackend
-from menshen_client import Configuration, IntrospectionRequest, TokenExchangeClient
-from menshen_client.exceptions import ResponseParsingError
 from rest_framework import authentication, exceptions
 
-from core.models import Application, ApplicationScope
+from core.models import Application
 from core.services import jwt_token
 
 User = get_user_model()
 logger = logging.getLogger(__name__)
 
 
-def get_bearer_token(request):
-    """Extract the bearer token from the Authorization header.
-
-    Returns:
-        Token string, or None if the request carries no bearer token
-
-    Raises:
-        AuthenticationFailed: If the Authorization header is malformed
-    """
-
-    auth_header = authentication.get_authorization_header(request).split()
-
-    if not auth_header or auth_header[0].lower() != b"bearer":
-        return None
-
-    if len(auth_header) != 2:
-        logger.warning("Invalid token header format")
-        raise exceptions.AuthenticationFailed("Invalid token header.")
-
-    try:
-        return auth_header[1].decode("utf-8")
-    except UnicodeError as e:
-        logger.warning("Token decode error: %s", e)
-        raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
-
-
 class BaseJWTAuthentication(authentication.BaseAuthentication):
     """Base JWT authentication class."""
 
@@ -101,12 +71,22 @@ class BaseJWTAuthentication(authentication.BaseAuthentication):
         if not self.is_enabled:
             return None
 
-        token = get_bearer_token(request)
+        auth_header = authentication.get_authorization_header(request).split()
 
-        if token is None:
+        if not auth_header or auth_header[0].lower() != b"bearer":
             # Defer to next authentication backend
             return None
 
+        if len(auth_header) != 2:
+            logger.warning("Invalid token header format")
+            raise exceptions.AuthenticationFailed("Invalid token header.")
+
+        try:
+            token = auth_header[1].decode("utf-8")
+        except UnicodeError as e:
+            logger.warning("Token decode error: %s", e)
+            raise exceptions.AuthenticationFailed("Invalid token encoding.") from e
+
         return self.authenticate_credentials(token)
 
     def decode_jwt(self, token):
@@ -272,139 +252,6 @@ class AddonsJWTAuthentication(BaseJWTAuthentication):
         )
 
 
-# Menshen grants scopes following La Suite's "service:resource:action" convention.
-# Map them to the scopes expected by the external API permissions.
-MENSHEN_SCOPES_MAPPING = {
-    "meet:room:create": ApplicationScope.ROOMS_CREATE,
-}
-
-
-class MenshenAuthentication(authentication.BaseAuthentication):
-    """Authentication for tokens exchanged through Menshen.
-
-    Menshen is La Suite's OAuth 2.0 token exchange server (RFC 8693): another service
-    exchanges its user's access token for a token targeting Meet, then calls the external
-    API on behalf of that user. Tokens are validated by introspection (RFC 7662). Menshen
-    only reports a token as active when Meet is among its audiences.
-    """
-
-    def __init__(self):
-        """Initialize the Menshen client from Django settings."""
-
-        super().__init__()
-
-        self._client = None
-
-        if not settings.MENSHEN_ENABLED:
-            return
-
-        self._client = TokenExchangeClient(
-            config=Configuration(
-                client_id=settings.MENSHEN_CLIENT_ID,
-                client_secret=settings.MENSHEN_CLIENT_SECRET,
-                server_root_url=settings.MENSHEN_SERVER_URL,
-            )
-        )
-
-    def authenticate(self, request):
-        """Introspect the bearer token with Menshen.
-
-        Returns:
-            Tuple of (user, payload) if the token is active, None otherwise
-        """
-
-        if self._client is None:
-            return None
-
-        token = get_bearer_token(request)
-
-        if token is None:
-            return None
-
-        payload = self.introspect(token)
-
-        if not payload.get("active"):
-            # Not a Menshen token, or an expired or revoked one: defer to next
-            # authentication backend
-            return None
-
-        user = self.get_user(payload)
-
-        scopes = payload.get("scope") or ""
-        payload["scope"] = [
-            MENSHEN_SCOPES_MAPPING[scope]
-            for scope in scopes.split()
-            if scope in MENSHEN_SCOPES_MAPPING
-        ]
-
-        return (user, payload)
-
-    def introspect(self, token):
-        """Submit the token to Menshen's introspection endpoint.
-
-        Errors are reported as an inactive token, so a Menshen outage doesn't
-        prevent the next authentication backends from running.
-
-        Args:
-            token: Bearer token string
-
-        Returns:
-            Introspection response dict
-        """
-
-        try:
-            response = self._client.introspect(IntrospectionRequest(token=token))
-        except (requests.RequestException, ResponseParsingError) as e:
-            logger.warning("Menshen introspection failed: %s", e)
-            return {"active": False}
-
-        # Permission classes expect a dict payload in request.auth
-        return asdict(response)
-
-    def get_user(self, payload):
-        """Retrieve or create the user from the introspection response.
-
-        Menshen forwards the `sub` and `email` of the subject token, as introspected
-        with the OIDC provider.
-
-        Args:
-            payload: Introspection response dict
-
-        Returns:
-            User instance
-
-        Raises:
-            AuthenticationFailed: If user not found or inactive
-        """
-
-        sub = payload.get("sub")
-
-        if not sub:
-            logger.warning("Missing 'sub' in Menshen introspection response")
-            raise exceptions.AuthenticationFailed("Invalid token claims.")
-
-        try:
-            user = User.objects.get(sub=sub)
-        except User.DoesNotExist as e:
-            if not settings.OIDC_CREATE_USER:
-                logger.warning("User not found: %s", sub)
-                raise exceptions.AuthenticationFailed("User not found.") from e
-
-            user = User(sub=sub, email=payload.get("email"))
-            user.set_unusable_password()
-            user.save()
-
-        if not user.is_active:
-            logger.warning("Inactive user attempted authentication: %s", user.pk)
-            raise exceptions.AuthenticationFailed("User account is disabled.")
-
-        return user
-
-    def authenticate_header(self, request):
-        """Return authentication scheme for WWW-Authenticate header."""
-        return "Bearer"
-
-
 class ResourceServerBackend(LaSuiteBackend):
     """OIDC Resource Server backend for user creation and retrieval."""
 

src/backend/core/external_api/viewsets.py

@@ -166,7 +166,6 @@ class RoomViewSet(
     authentication_classes = [
         authentication.ApplicationJWTAuthentication,
         authentication.AddonsJWTAuthentication,
-        authentication.MenshenAuthentication,
         ResourceServerAuthentication,
     ]
     permission_classes = [

src/backend/core/tests/test_external_api_menshen.py

@@ -1,209 +0,0 @@
-"""Tests for the external API MenshenAuthentication."""
-
-from unittest import mock
-
-import pytest
-import responses
-from lasuite.oidc_resource_server.authentication import ResourceServerAuthentication
-from rest_framework.test import APIClient
-
-from core.factories import UserFactory
-from core.models import RoleChoices, Room, User
-
-pytestmark = pytest.mark.django_db
-
-SERVER_URL = "https://menshen.example.com"
-INTROSPECTION_ENDPOINT = f"{SERVER_URL}/auth/token/introspect/"
-TOKEN = "menshen-exchanged-token"
-
-
-@pytest.fixture(autouse=True)
-def menshen_settings(settings):
-    """Enable Menshen authentication."""
-    settings.MENSHEN_ENABLED = True
-    settings.MENSHEN_SERVER_URL = SERVER_URL
-    settings.MENSHEN_CLIENT_ID = "meet"
-    settings.MENSHEN_CLIENT_SECRET = "meet-secret"
-
-
-def _introspection(sub, scope="meet:room:create", **overrides):
-    return {
-        "active": True,
-        "sub": sub,
-        "email": "user@example.com",
-        "scope": scope,
-        "aud": "meet",
-        "client_id": "menshen",
-        **overrides,
-    }
-
-
-def _create_room():
-    client = APIClient()
-    client.credentials(HTTP_AUTHORIZATION=f"Bearer {TOKEN}")
-    return client.post("/external-api/v1.0/rooms/", {}, format="json")
-
-
-@responses.activate
-def test_menshen_active_token():
-    """An active token with a mapped scope should create a room owned by the user."""
-
-    user = UserFactory()
-
-    # Catch and mock external HTTP requests
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub),
-        match=[responses.matchers.urlencoded_params_matcher({"token": TOKEN})],
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 201
-    room = Room.objects.get(id=response.data["id"])
-    assert room.get_role(user) == RoleChoices.OWNER
-    assert responses.calls[0].request.headers["Authorization"].startswith("Basic ")
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_disabled(mock_rs_authenticate, settings):
-    """Menshen should not be called when disabled."""
-
-    settings.MENSHEN_ENABLED = False
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert len(responses.calls) == 0
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_inactive_token_defers(mock_rs_authenticate):
-    """An inactive token should defer to the next authentication backend."""
-
-    user = UserFactory()
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub, scope="meet:room:create", active=False),
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_error_defers(mock_rs_authenticate):
-    """A Menshen error should defer to the next authentication backend."""
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, status=500)
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-@mock.patch.object(ResourceServerAuthentication, "authenticate", return_value=None)
-def test_menshen_unparsable_response_defers(mock_rs_authenticate):
-    """A response the client can't parse should defer to the next backend."""
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json={"active": True, "unexpected": "field"},
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    mock_rs_authenticate.assert_called_once()
-
-
-@responses.activate
-def test_menshen_unmapped_scope():
-    """Scopes granted for other services or other Meet actions should not grant access."""
-
-    user = UserFactory()
-
-    responses.add(
-        responses.POST,
-        INTROSPECTION_ENDPOINT,
-        json=_introspection(user.sub, scope="drive:item:create meet:room:list"),
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 403
-    assert "insufficient permissions." in str(response.data).lower()
-    assert not Room.objects.exists()
-
-
-@responses.activate
-def test_menshen_missing_sub():
-    """An active token without sub should be rejected."""
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, json=_introspection(None))
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "invalid token claims." in str(response.data).lower()
-
-
-@responses.activate
-def test_menshen_inactive_user():
-    """An active token for an inactive user should be rejected."""
-
-    user = UserFactory(is_active=False)
-
-    responses.add(responses.POST, INTROSPECTION_ENDPOINT, json=_introspection(user.sub))
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "user account is disabled." in str(response.data).lower()
-
-
-@responses.activate
-def test_menshen_unknown_user_created(settings):
-    """An unknown sub should create a user when OIDC_CREATE_USER is set."""
-
-    settings.OIDC_CREATE_USER = True
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("new-sub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 201
-    user = User.objects.get(sub="new-sub")
-    assert user.email == "user@example.com"
-    assert user.is_active is True
-
-
-@responses.activate
-def test_menshen_unknown_user_not_created(settings):
-    """An unknown sub should be rejected when OIDC_CREATE_USER is unset."""
-
-    settings.OIDC_CREATE_USER = False
-
-    responses.add(
-        responses.POST, INTROSPECTION_ENDPOINT, json=_introspection("new-sub")
-    )
-
-    response = _create_room()
-
-    assert response.status_code == 401
-    assert "user not found." in str(response.data).lower()
-    assert not User.objects.filter(sub="new-sub").exists()

src/backend/meet/settings.py

@@ -702,20 +702,6 @@ class Base(Configuration):
         default=None, environ_name="OIDC_RS_SCOPES_PREFIX", environ_prefix=None
     )
 
-    # Menshen, La Suite's OAuth 2.0 token exchange server
-    MENSHEN_ENABLED = values.BooleanValue(
-        False, environ_name="MENSHEN_ENABLED", environ_prefix=None
-    )
-    MENSHEN_SERVER_URL = values.Value(
-        None, environ_name="MENSHEN_SERVER_URL", environ_prefix=None
-    )
-    MENSHEN_CLIENT_ID = values.Value(
-        None, environ_name="MENSHEN_CLIENT_ID", environ_prefix=None
-    )
-    MENSHEN_CLIENT_SECRET = SecretFileValue(
-        None, environ_name="MENSHEN_CLIENT_SECRET", environ_prefix=None
-    )
-
     # Video conference configuration
     LIVEKIT_CONFIGURATION = {
         "api_key": SecretFileValue(environ_name="LIVEKIT_API_KEY", environ_prefix=None),

src/backend/pyproject.toml

@@ -49,7 +49,6 @@ dependencies = [
     "gunicorn==26.2.0",
     "jsonschema==4.26.0",
     "markdown==3.10.3",
-    "menshen-client==0.1.0",
     "nested-multipart-parser==1.6.0",
     "posthog==7.44.0",
     "psycopg[binary]==3.3.4",

src/backend/uv.lock

@@ -1327,7 +1327,6 @@ dependencies = [
     { name = "jsonschema" },
     { name = "livekit-api" },
     { name = "markdown" },
-    { name = "menshen-client" },
     { name = "mozilla-django-oidc" },
     { name = "nested-multipart-parser" },
     { name = "phonenumbers" },
@@ -1393,7 +1392,6 @@ requires-dist = [
     { name = "jsonschema", specifier = "==4.26.0" },
     { name = "livekit-api", specifier = "==1.2.0" },
     { name = "markdown", specifier = "==3.10.3" },
-    { name = "menshen-client", specifier = "==0.1.0" },
     { name = "mozilla-django-oidc", specifier = "==5.0.2" },
     { name = "nested-multipart-parser", specifier = "==1.6.0" },
     { name = "phonenumbers", specifier = "==9.0.37" },
@@ -1430,18 +1428,6 @@ dev = [
     { name = "types-requests", specifier = "==2.33.0.20260712" },
 ]
 
-[[package]]
-name = "menshen-client"
-version = "0.1.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "requests" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/53/d5/c2be400c190efe26b70e5c60dd9d9ab279ece3b51de457abc184a238c727/menshen_client-0.1.0.tar.gz", hash = "sha256:21fe48788e860c7f2e103787ce0827981e9059146cf7bdb9ac1a8778acb9ff77", size = 6219, upload-time = "2026-09-21T21:04:01.677Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/d6/bf/11d15da4852b8344eb9f30861bd15a8f1d931ff4232d9b7de18fce09fd3c/menshen_client-0.1.0-py3-none-any.whl", hash = "sha256:d0dfb351812bb93620a4796e0f0ce1a40e8ec859dc8de2a1f50ae7f306d4d29a", size = 7040, upload-time = "2026-09-21T21:04:00.433Z" },
-]
-
 [[package]]
 name = "mozilla-django-oidc"
 version = "5.0.2"

src/frontend/package-lock.json

@@ -64,7 +64,8 @@
         "typescript-eslint": "8.60.1",
         "vite": "8.0.14",
         "vite-plugin-static-copy": "4.1.1",
-        "vite-plugin-svgr": "5.2.0"
+        "vite-plugin-svgr": "5.2.0",
+        "vitest": "5.0.2"
       }
     },
     "node_modules/@adobe/react-spectrum": {
@@ -942,9 +943,9 @@
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "dev": true,
       "license": "MIT"
     },
@@ -2506,6 +2507,24 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/dom-mediacapture-record": {
       "version": "1.0.22",
       "resolved": "https://registry.npmjs.org/@types/dom-mediacapture-record/-/dom-mediacapture-record-1.0.22.tgz",
@@ -2786,6 +2805,64 @@
         }
       }
     },
+    "node_modules/@vitest/mocker": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-5.0.2.tgz",
+      "integrity": "sha512-Z5FS00Q1SJHkB35xATsmWGdQ5WA1/0MV3CDjqyv7GavHv1OfOj145MNfHOlHk7QLes21dKFDHr8EO2zvL+9WGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.31",
+        "@vitest/spy": "5.0.2",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^1.2.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/@vitest/mocker/node_modules/magic-string": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
+      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-5.0.2.tgz",
+      "integrity": "sha512-Ijc7T1nT9efNb5LxvjaBrEqw3f/QwUv5EE0nKqZxgqsaV/FxAAZ8baGylA8X/Z2oS4Lp+K74Jr6dTJsDKxJDeg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vue/compiler-core": {
       "version": "3.5.25",
       "resolved": "https://registry.npmjs.org/@vue/compiler-core/-/compiler-core-3.5.25.tgz",
@@ -3151,6 +3228,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/ast-types-flow": {
       "version": "0.0.8",
       "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
@@ -4130,6 +4217,16 @@
       ],
       "license": "CC-BY-4.0"
     },
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/chalk": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
@@ -5030,6 +5127,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
@@ -5532,6 +5636,16 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/expect-type": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.4.0.tgz",
+      "integrity": "sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/express": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
@@ -8647,6 +8761,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/obug": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.2.1.tgz",
+      "integrity": "sha512-XrsrhT5sybtKI6wakr2SPOlGZWWYbUXZ7a0jT8/QOeAPau+1X/bSegNe5YR75oJmEZQbKningirmGOEJCIk61Q==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.20.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -10220,6 +10348,13 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/std-env": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.3.0.tgz",
+      "integrity": "sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/stop-iteration-iterator": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
@@ -10526,6 +10661,26 @@
         "xtend": "~4.0.1"
       }
     },
+    "node_modules/tinybench": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-6.2.0.tgz",
+      "integrity": "sha512-78U2TlB2CnVenajOFzf3BKSm0J6oz5L0NV7g32LCPccvYc0lbWvys4d3uUUCS2B1N8PAf2+aekR8i1KbC3HO7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/tinyexec": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.3.1.tgz",
+      "integrity": "sha512-GCvB3aoys96IuDFBMcTB46JOR6mdMtAToqwiW8JlWhsoh1mhHi/xn9ss/Dg7N555GiJyEt2qzoG/NHCwM6h1EA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tinyglobby": {
       "version": "0.2.17",
       "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
@@ -11610,6 +11765,112 @@
         "url": "https://github.com/sponsors/jonschlinkert"
       }
     },
+    "node_modules/vitest": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-5.0.2.tgz",
+      "integrity": "sha512-7MQrx9pDv5aHiUcovIb/70Ys3tgtkUVgCtledvKdCmEO+/1Dicq5ZqoSxOW034m03oqC+oHOKui2dM6qtMLoJg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/mocker": "5.0.2",
+        "chai": "^6.2.2",
+        "es-module-lexer": "^2.3.2",
+        "expect-type": "^1.4.0",
+        "magic-string": "^1.2.3",
+        "obug": "^2.1.4",
+        "picomatch": "^4.0.7",
+        "std-env": "^4.2.0",
+        "tinybench": "^6.1.4",
+        "tinyexec": "^1.3.0",
+        "tinyglobby": "^0.2.17",
+        "why-is-node-running": "^3.2.1"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@opentelemetry/api": "^1.9.0",
+        "@types/node": "^22.0.0 || >=24.0.0",
+        "@vitest/browser-playwright": "5.0.2",
+        "@vitest/browser-preview": "5.0.2",
+        "@vitest/browser-webdriverio": "^5.0.0-beta.5 || >=5.0.0",
+        "@vitest/coverage-istanbul": "5.0.2",
+        "@vitest/coverage-v8": "5.0.2",
+        "@vitest/ui": "5.0.2",
+        "happy-dom": "*",
+        "jsdom": "*",
+        "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/browser-preview": {
+          "optional": true
+        },
+        "@vitest/browser-webdriverio": {
+          "optional": true
+        },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        },
+        "vite": {
+          "optional": false
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/magic-string": {
+      "version": "1.4.2",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-1.4.2.tgz",
+      "integrity": "sha512-vG+rjFRj1PqdIBozIxAGMjPlOhaVe+GXpbttY/iSK7rGcJRMlwNJO7dcUwmUqkymsFLJiNGI06t4D7Fr7yRC9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.6.0"
+      }
+    },
+    "node_modules/vitest/node_modules/picomatch": {
+      "version": "4.0.7",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
+      "integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/walk-sync": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/walk-sync/-/walk-sync-2.2.0.tgz",
@@ -11794,6 +12055,19 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/why-is-node-running": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-3.2.2.tgz",
+      "integrity": "sha512-NKUzAelcoCXhXL4dJzKIwXeR8iEVqsA0Lq6Vnd0UXvgaKbzVo4ZTHROF2Jidrv+SgxOQ03fMinnNhzZATxOD3A==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=20.11"
+      }
+    },
     "node_modules/word-wrap": {
       "version": "1.2.5",
       "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",

src/frontend/package.json

@@ -7,6 +7,7 @@
     "dev": "panda codegen && vite",
     "build": "panda codegen && tsc -b && vite build",
     "build:debug": "VITE_ANALYZE=true npm run build -- --debug",
+    "test": "panda codegen && vitest run",
     "lint": "eslint . --ext ts,tsx --report-unused-disable-directives --max-warnings 0",
     "lint:fix": "eslint . --fix",
     "preview": "vite preview",
@@ -71,6 +72,7 @@
     "typescript-eslint": "8.60.1",
     "vite": "8.0.14",
     "vite-plugin-static-copy": "4.1.1",
-    "vite-plugin-svgr": "5.2.0"
+    "vite-plugin-svgr": "5.2.0",
+    "vitest": "5.0.2"
   }
 }

src/frontend/src/features/rooms/utils/isRoomValid.test.ts

@@ -0,0 +1,14 @@
+import { describe, expect, it } from 'vitest'
+import { normalizeRoomId } from './isRoomValid'
+
+describe('normalizeRoomId', () => {
+  it('lowercases and re-inserts the hyphens of a ten-letter id', () => {
+    expect(normalizeRoomId('ABCDEFGHIJ')).toBe('abc-defg-hij')
+    expect(normalizeRoomId('abc-defghij')).toBe('abc-defg-hij')
+  })
+
+  it('returns any other input unchanged', () => {
+    expect(normalizeRoomId('abc-def')).toBe('abc-def')
+    expect(normalizeRoomId('Not-A-Room')).toBe('Not-A-Room')
+  })
+})

src/frontend/tsconfig.node.json

@@ -10,5 +10,5 @@
     "noEmit": true,
     "types": ["node"]
   },
-  "include": ["vite.config.ts"]
+  "include": ["vite.config.ts", "vitest.config.ts"]
 }

src/frontend/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from 'vitest/config'
+
+// Kept apart from vite.config.ts so the tests load none of the build plugins.
+export default defineConfig({
+  resolve: {
+    tsconfigPaths: true,
+  },
+})